BOD 26-04 does something useful: it tells federal agencies which small slice of their vulnerability backlog has to be fixed in three days. At the pilot agency, that was about 1% of instances. More than 60% could wait for the next upgrade.
That answers the urgency question. It leaves the value question open.
Deferred is not the same as harmless
A finding in Tier 4 or Tier 5 has been judged less urgent. It has not been judged worthless to an attacker. Lower-tier findings chain together, sit on systems that hold valuable data, and become Tier 1 overnight when they land in KEV.
So the tiering creates a new management problem: a large, legitimately deferred backlog that still carries risk, and no common unit to describe it.
Boards and underwriters act on numbers. A tier list on its own is not one.
From tiers to dollars
The variables BOD 26-04 uses to tier a finding are the same ones that drive loss: exposure, exploitation, automation and impact. Add what the affected asset is worth to the business, and each finding can carry a dollar figure as well as a tier.
Question | Tier view | Dollar view |
|---|---|---|
What must we fix this week? | Tier 1 and 2 | Same, plus forensic triage cost |
What can wait? | Tiers 4 and 5 | How much loss we are carrying by waiting |
Where should spare capacity go? | Not answered | Highest dollar risk per hour of effort |
What do we tell the board or the prime? | A compliance list | A residual risk figure and its trend |
In plain language
CISA tells you which 1% to fix in three days. A dollar view tells you what the other 99% is worth, so you can decide what to fix next and defend what you leave.
Why this matters to contractors and MSPs
Primes and agencies will ask for the tier list. Boards will ask what it means. Underwriters will ask how much of the backlog sits on internet-facing systems. One model that answers all three, from the same evidence, saves doing the work three times.
A free exposure check
We will show which of your internet-facing assets would be on a three-day clock today. Twenty minutes, no deck. Book the exposure check →
Next step. The BOD 26-04 briefing pack covers the tiers, the timeline and how the directive reaches contractors and MSPs. Get the briefing pack →
For any comments or information please reach out to info@astragar.com
See your cyber risk in $ terms, not CVSS scores.
